Sensor Settings

The SonicWall Endpoint Security policy enables to manage the SES version on the endpoint devices.

To configure the Sensor Settings

1. Log into the SES Management Console and select the Tenant to configure the Sensor settings.
2. Navigate to Policy > Sensor.
3. In the Sensor settings section, enable the Protection settings. These settings define how the sensor detects, analyzes, and prevents threats across memory, files, and system behavior.
   • Memory Detection - Identify the malicious memory detected file on the endpoint.

   • Behavior Detection - Identify the malicious behavior on the endpoint.

4. Enable the File Detection to reduce the risk and detect the malicious file on the endpoint.

   • Either enable or disable the RTDMI Verdict Block option.

     Despite its name, this option does not itself block execution. When enabled, the SES agent allows the process to execute while the RTDMI cloud analysis runs in parallel; the process is not paused pending the verdict.

   • Either enable or disable the Block Execution Until RTDMI Verdict option.

     When enabled, the SES agent pauses (blocks) execution of the detected process until the RTDMI cloud verdict is returned. This provides stronger protection at the cost of potential execution latency.

5. In the Sensor settings section, enable the Telemetry settings.These settings are critical for behavioral analysis and threat hunting. Any change to the following settings requires a system reboot.
   • Process Activity - To collect the process activity from the endpoint.
     • File Activity - To collect the file activity from the endpoint.
     • Registry Activity - To collect the registry activity from the endpoint.
     • Network Activity - To collect the network activity from the endpoint.

   • Security Activity - To collect the security activity from the endpoint.

   • Telemetry Cloud Upload - This setting send the collected telemetry to our secured cloud. It essentially parse the Winevents that were collected as part of Process & Security Activity based on the policy configuration.

6. In the Deployment Settings section:
   • On the Sensor tab, in the Deployment Settings section, open the Version drop-down list.

   • Select Auto Update (Latest) to update the agent automatically when a new release is available, or select a specific version.

7. In the Configuration section:

   • Select the Anti-Tamper to apply all the anti-tamper settings.

   • Select Detect only mode to have the agent report threats without blocking or quarantining them.

     After you enable Detect only mode, the agent continues to detect files that block mode blocked, until the system is rebooted.

   • Select the Debug Logs option to generate the debug logs for reference.

8. Enable Inherit Sensor Settings from Parent to apply the settings from the parent scope.
9. In the Policy Inheritance Settings section:
   • Enable the Inherited Exclusion policies from Parent to apply the settings from the parent scope.

   • Enable the Inherited Blocklist policies from Parent to apply the settings from the parent scope.

   • Enable the Inherited Device Control policies from Parent to apply the settings from the parent scope.

   • Enable the Inherited Custom Rule policies from Parent to apply the settings from the parent scope.

10. Click Save.